CVE-2018-1321 EXPLOIT
7.2
HIGH · CVSS 3.0 · EPSS 17.5% (pctl 97)
Patch early
A public exploit exists.
Description
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
Scoring
| CVSS | 7.2 (HIGH, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 17.52% — more likely to be exploited than 97% of all CVEs |
| Weakness | CWE-20 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2018-03-20 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| apache | syncope |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Apache Syncope 2.0.7 - Remote Code Execution | 2018-09-13 |
References
- http://syncope.apache.org/security.html#CVE-2018-1321:_Remote_code_execution_by_administrators_with_report_and_template_entitlements
- http://www.securityfocus.com/bid/103508
- https://www.exploit-db.com/exploits/45400/
- http://syncope.apache.org/security.html#CVE-2018-1321:_Remote_code_execution_by_administrators_with_report_and_template_entitlements
- http://www.securityfocus.com/bid/103508
- https://www.exploit-db.com/exploits/45400/
→ the Explorer · watch your stack · NVD